Vikunja

vikunja.io
Awesome Privacy➔ Productivity➔ Task Management➔ Vikunja
Vikunja

Vikunja is an open-source to-do application. It is suitable for a wide variety of projects, supporting List, Gantt, Table and Kanban views to visualize all tasks in different contexts. For collaboration, it has sharing support via private teams or public links. It can be self-hosted or used as a managed service for a small fee.

Avoid

  • todoist
  • microsoft to do
  • ticktick
  • any.do
  • asana

Also Consider

Open Source

Vikunja Source Code

Author

go-vikunja

Description

The task manager you actually own.

#api#golang#project-management#self-hosted#todo#todoapp#todolist#vuejs

Homepage

https://vikunja.io

Repository

  • LicenseAGPL-3.0
  • Created28 Nov 18
  • Primary languageGo
  • Size109,274 KB
  • Stars5,255
  • Forks661
  • Watchers5,255

Language Usage

Language Usage

Project Health

  • Last commit5 days ago
  • Open issues221
  • Latest releasevue3

Top Contributors

Recent Commits

  • Tink(02 Sept 26)

    fix(editor): don't strike through nested checklist items of a checked parent (#3715) Unchecked checklist item nested under checked parent rendered greyed out and struck through, so it looked checked. Cause: `li[data-checked='true']` styled whole list item, including nested task list inside item's content div. `text-decoration` propagates to descendants and cannot be reset by child. Rule now scoped to item's own content. Fixes #3712 ## How to verify 1. Create a task and open it. 2. Edit the description, add a checklist item "Parent item", then press Enter and Tab to nest a second item "Child item" underneath it. 3. Check the checkbox of "Parent item" only, and save. 4. **Expected:** "Parent item" is greyed out and struck through. "Child item" keeps normal text colour with no strikethrough, and its checkbox stays unchecked. **Before this PR:** "Child item" was greyed out and struck through too, making it look checked. --------- Co-authored-by: kolaente <[email protected]> Co-authored-by: kolaente <[email protected]>

  • Tea Reggi(02 Sept 26)

    fix(db): redact PostgreSQL credentials from connection errors (#3707)

  • renovate[bot](02 Sept 26)

    fix(deps): update module github.com/go-sql-driver/mysql to v1.10.1

  • renovate[bot](02 Sept 26)

    chore(deps): update dependency happy-dom to v20.12.0

  • renovate[bot](02 Sept 26)

    chore(deps): update dependency go to v1.27.1

  • renovate[bot](02 Sept 26)

    fix(deps): update module github.com/coreos/go-oidc/v3 to v3.21.0

  • Frederick [Bot](02 Sept 26)

    chore(i18n): update translations via Crowdin

  • renovate[bot](01 Sept 26)

    chore(deps): update dependency serialize-javascript to v7.1.1

  • renovate[bot](01 Sept 26)

    chore(deps): update pnpm to v11.25.0

  • renovate[bot](01 Sept 26)

    chore(deps): update dependency ip-address to v10.7.0

  • renovate[bot](01 Sept 26)

    fix(deps): update module github.com/aws/aws-sdk-go-v2/config to v1.33.2

  • renovate[bot](01 Sept 26)

    chore(deps): update dependency happy-dom to v20.11.15

  • renovate[bot](01 Sept 26)

    fix(deps): update aws-sdk-go-v2 monorepo

  • kolaente(31 Aug 26)

    refactor(frontend): consolidate task identifier display

  • kolaente(31 Aug 26)

    chore(ai): make vikunja skills generally available

  • kolaente(31 Aug 26)

    docs: trim derivable content from AGENTS.md Cut the sections a session can reconstruct by reading the repo: the project overview and directory layout, the architecture tour, the mage target and pnpm script enumerations, the Go tooling tips, the step lists that restated the Skills section, the ESLint rule list already enforced by eslint.config.js, and a duplicated permissions block. Replaces the worktree and e2e walkthroughs with pointers to the new skills, keeping their guarding prohibitions ("never run pnpm test:e2e directly", "always save test output to a file") in the root file so they do not depend on a skill being loaded. 17500 -> 8466 chars, roughly 2.2k fewer tokens loaded every session.

  • kolaente(31 Aug 26)

    docs: add prepare-worktree and run-e2e-tests skills Move the worktree setup and e2e runner walkthroughs out of the always-loaded AGENTS.md and into skills that load on invocation.

  • renovate[bot](31 Aug 26)

    fix(deps): update dependency @sentry/vue to v10.72.0

  • renovate[bot](31 Aug 26)

    chore(deps): update crowdin/github-action action to v3.0.1

  • kolaente(31 Aug 26)

    refactor(frontend): migrate labels to v2 client

  • kolaente(31 Aug 26)

    feat(frontend): configure v2 client runtime

  • kolaente(31 Aug 26)

    ci: verify generated frontend client is current

  • kolaente(31 Aug 26)

    feat(api): generate canonical v2 frontend client

  • kolaente(31 Aug 26)

    chore: v2.6.0 release preparations

  • kolaente(31 Aug 26)

    fix(migration): reload conflicting claims after rollback

  • kolaente(31 Aug 26)

    test(migration): handle database id sequences

  • kolaente(31 Aug 26)

    test(e2e): make team owner a fixture member

  • kolaente(30 Aug 26)

    chore: regenerate yaegi symbols

  • kolaente(30 Aug 26)

    fix(migration): bound vikunja file imports Preflight over the declared uncompressed sizes (overflow-safe), a file count cap and a per-user storage quota bound the import before anything is read; the actual decompressed bytes are still counted against the same budget while reading. Attachments and backgrounds now stream through a lazy provider: one zip entry is decompressed into a private temp file at a time. A failed import deletes the file blobs it wrote, which were orphaned for every migrator before.

  • kolaente(30 Aug 26)

    fix(migration): bound planka import resources Per-job budget: 128 MiB aggregate response bytes (counted while decoding, not from Content-Length), 64 MiB retained attachments, 50,000 decoded entities and 2,000 outbound request attempts counted at the transport level so retries cannot multiply work. The per-response cap drops to 4 MiB. Budget exhaustion aborts the import with a typed error; ordinary 404/timeout attachment failures keep the log-and-skip.

Vikunja Security

Security Advisories (65)

  • highPatched

    GHSA-xxc3-xpmc-vmvrUnbounded nested task-filter recursion permits API process termination

  • highPatched

    GHSA-pqf9-h8g4-8gmhUnbounded CSV row cardinality permits API process termination

  • highPatched

    GHSA-wq92-8x3r-fm38Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

  • mediumPatched

    GHSA-4vh2-39rq-rq8jUnbounded image decode on avatar and project-background uploads enables decode/resize amplification

  • mediumPatched

    GHSA-6rvj-qwjf-3m4qEvery /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

  • mediumPatched

    GHSA-m469-88xx-8rx2CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

  • lowPatched

    GHSA-8wvg-r2j4-3737Assignee email addresses disclosed to read-only project members via the task assignees endpoint

  • mediumPatched

    GHSA-jp29-jrxc-92vfFavorited tasks remain readable after project access is revoked, including content written post-revocation

  • mediumPatched

    GHSA-g38j-7v97-x298CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

  • lowPatched

    GHSA-w2ch-4xgr-22wwTask relation deletion does not check read access to the other task, allowing cross-project relation removal

  • mediumPatched

    GHSA-3hc7-r24j-rpwcCross-project task disclosure through subtask expansion

  • highPatched

    GHSA-w7jp-mf2v-8342Denial of service via decompression bomb in the data import

  • mediumPatched

    GHSA-39p5-2wrr-xh29Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

  • mediumPatched

    GHSA-vfxw-3x8p-2vjrLink-share token can enumerate users through the v2 API

  • mediumPatched

    GHSA-88f6-4rjv-x774TOTP secret is readable after enrollment, no step-up auth

  • mediumPatched

    GHSA-9rg3-v78m-26q8API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

  • lowPatched

    GHSA-w39f-h553-h2mxCross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

  • highPatched

    GHSA-qfwc-vx6f-3g6gRead-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

  • highPatchedCVSS 7.5

    CVE-2026-76216Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

  • highPatchedCVSS 8.1

    GHSA-vvcv-vpph-h844Link-share principal ID collision allows cross-account API token issuance and management

  • highPatched

    GHSA-rj9j-8772-4h6cLink-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • highPatched

    CVE-2026-62367OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

  • highPatchedCVSS 8.1

    CVE-2026-62376Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

  • mediumPatched

    CVE-2026-54766Project duplication bypasses write-permission check on the target parent project

  • mediumPatchedCVSS 5

    CVE-2026-55067Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

  • highPatchedCVSS 8.1

    CVE-2026-57458Scoped API token can mint unrestricted OAuth session credentials

  • highPatchedCVSS 7.1

    CVE-2026-55066Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

  • highPatchedCVSS 8.1

    CVE-2026-55065Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

  • mediumPatchedCVSS 4.3

    CVE-2026-55064Incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

  • mediumPatchedCVSS 4.3

    CVE-2026-40103Scoped API tokens with projects.background permission can delete project backgrounds

  • highPatchedCVSS 7.4

    CVE-2026-34727TOTP Two-Factor Authentication Bypass via OIDC Login Path

  • mediumPatchedCVSS 4.1

    CVE-2026-35601iCalendar Property Injection via CRLF in CalDAV Task Output

  • mediumPatchedCVSS 5.4

    CVE-2026-35600HTML Injection via Task Titles in Overdue Email Notifications

  • mediumPatchedCVSS 6.5

    CVE-2026-35599Algorithmic Complexity DoS in Repeating Task Handler

  • mediumPatchedCVSS 5.4

    CVE-2026-35602File Size Limit Bypass via Vikunja Import

  • mediumPatchedCVSS 4.3

    CVE-2026-35598Missing Authorization on CalDAV Task Read

  • mediumPatchedCVSS 5.9

    CVE-2026-35597TOTP Brute-Force Due to Non-Functional Account Lockout

  • mediumPatchedCVSS 4.3

    CVE-2026-35596Broken Access Control on Label Read via SQL Operator Precedence Bug

  • highPatchedCVSS 8.3

    CVE-2026-35595Privilege Escalation via Project Reparenting

  • mediumPatchedCVSS 6.5

    CVE-2026-35594Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

  • mediumPatched

    CVE-2026-33700Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

  • highPatched

    CVE-2026-33668Disabled/Locked User Accounts Can Still Authenticate via API Tokens, CalDAV, and OpenID Connect

  • mediumPatchedCVSS 6.4

    CVE-2026-33679SSRF via OpenID Connect Avatar Download Bypasses Webhook SSRF Protections

  • mediumPatchedCVSS 6.4

    CVE-2026-33675SSRF via Todoist/Trello Migration File Attachment URLs Allows Reading Internal Network Resources

  • mediumPatchedCVSS 6.5

    CVE-2026-33676Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

  • mediumPatchedCVSS 6.5

    CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

  • highPatchedCVSS 8.1

    CVE-2026-33678IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

  • highPatchedCVSS 7.5

    CVE-2026-33680Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

  • criticalPatchedCVSS 9.1

    GHSA-2pv8-4c52-mf8jUnauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

  • highPatched

    CVE-2026-33334Any frontend XSS escalates to Remote Code Execution due to nodeIntegration in Vikunja Desktop

  • highPatched

    CVE-2026-33335Arbitrary local application invocation via unvalidated shell.openExternal in Vikunja Desktop

  • criticalPatched

    CVE-2026-33336Remote Code Execution via same-window navigation in Vikunja Desktop

  • mediumPatched

    CVE-2026-33313IDOR in Task Comments Allows Reading Arbitrary Comments

  • mediumPatched

    CVE-2026-33312Read-only users can delete project background images via broken object-level authorization

  • mediumPatched

    CVE-2026-333152FA Bypass via Caldav Basic Auth

  • highPatchedCVSS 8.1

    CVE-2026-33316Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

  • mediumPatchedCVSS 5.7

    CVE-2026-33473TOTP Reuse During Validity Window

  • highPatched

    CVE-2026-33474DoS via Image Preview Generation

  • mediumPatchedCVSS 5.3

    CVE-2026-29794Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

  • criticalPatchedCVSS 9.8

    CVE-2026-28268Account Takeover via Password Reset Token Reuse

  • highPatchedCVSS 7.2

    CVE-2026-27819Path Traversal in CLI Restore

  • criticalPatchedCVSS 9.1

    CVE-2026-27575Weak Password Policy Combined with Persistent Sessions After Password Change

  • highPatchedCVSS 7.3

    CVE-2026-27616Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

  • mediumPatchedCVSS 6.1

    CVE-2026-27116Reflected HTML Injection via filter Parameter in Projects Module

  • highPatched

    CVE-2026-25935XSS Via Task Preview

Vikunja Website

Website

Vikunja: The task manager you actually own

Vikunja is open-source task management you can self-host. Lists, Kanban, Gantt, and more — on your server or ours. Made and hosted in the EU.

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address172.67.172.167
  • LocationSan Francisco,California,United States of America,NA
  • ISPCloudFlare Inc.
  • ASNAS13335

Associated Countries

  • USUS
  • DEDE

Safety Score

Website marked as safe

100%

Blacklist Check

vikunja.io was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Vikunja Docker

Container Info

Vikunja

The to-do app to organize your life.| Before use create custom template and Edit: VIKUNJA_SERVICE_FRONTENDURL , VIKUNJA_API_URL & VIKUNJA_SERVICE_JWTSECRET

#Tools#Productivity

Run Command

docker run -d \
  -e PUID=${PUID} \
  -e PGID=${PGID} \
  -e PORT=${PORT} \

Compose File

version: 3.8
services:
  vikunja:
    environment:
      PUID: 1000
      PGID: 1000
      PORT:

Environment Variables

  • Var NameDefault
  • PUID1000
  • PGID1000
  • PORTnull

Vikunja Reviews

More Task Management

View More...

About the Data: Vikunja

Change History

  • Moved from Productivity › Cloud Productivity Suites by @ltguillaume #805

Edit Vikunja Data

You can edit Vikunja's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Vikunja Submit Edit to Vikunja Add alternative

API

You can access Vikunja's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/vikunja

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Vikunja

Help your friends compare Task Management, and pick privacy-respecting software and services.
Share Vikunja and Awesome Privacy with your network!

← Previous

Mindwtr

View Task Management (3)